I'd rather see 'phoenix' style systems catch on, even for desktops. Don't try to repair a system with 1,000,000 random files in it. Just have a plan to automati

I'd rather see 'phoenix' style systems catch on, even for desktops. Don't try to repair a system with 1,000,000 random files in it. Just have a plan to automatically rebuild it from a list of pinned packages and a folder of your personal data. Scanning the system from within the system feels bound to fail, when a lot of my stuff has to run as root. Even if I'm not root, there is this: https://xkcd.com/1200/ https://xkcd.com/1200/ But if you want jails and read-only FS, you can try to construct it from something like Docker. With LVM you can make point-in-time FS snapshots and scan those. Docker probably has known escapes, but if your scanner is FOSS you could layer it inside a wasm runtime too. Defense-in-depth doctrine says that something is better than nothing, but I feel like expecting a broken system to report that it's broken and fix itself is a bit doomed. Having a physically separate audit server behind a data diode is also an approach I've considered. That way malware is less able to hide logs once it's in. The trouble is, all these ideas require lots of new code that nobody has a reason to trust or maintain or use.